The flaw is located in the updateAvatar endpoint of the co.yixiang.utils.FileUtil component. A malicious user can manipulate the File argument to bypass server validation and upload any file type. Because the upload is unrestricted, an attacker could potentially place executable scripts or web shells on the server, leading to remote code execution or other malicious activity. The CVSS score of 5.3 indicates moderate severity, and the attack can be carried out remotely, as stated in the description.

Affected systems include the YSHOPMall application provided by guchengwuyue, versions up to and including 1.9.1. The vulnerability resides in /api/users/updateAvatar and any installation running a vulnerable version without an applied fix is exposed. No other versions beyond 1.9.1 have been verified as secure, so users must confirm their local installation version and upgrade if necessary.

Risk assessment shows a moderate CVSS score of 5.3 and an EPSS of less than 1%, indicating a low but non‑zero exploitation probability. The flaw is not listed in CISA’s KEV catalog, yet a public exploit exists and the remote nature of the issue means attackers can trigger it over the Internet. The vulnerability hinges on insufficient file type validation (CWE‑434) and lack of proper access control (CWE‑284), forming the basis of the attack path. Organizations using YSHOPMall should treat this flaw as a security risk that requires prompt attention.